On 2 November 1988, Robert Tappan Morris released a program onto the early internet that exploited bugs in fingerd and sendmail plus weak passwords to copy itself onto other VAX and Sun hosts. It became the first worm to spread widely across a real production network and effectively founded the field of incident response.
This simulator runs a discrete-time epidemic model on a random network graph of N hosts, each connected to its topological neighbours plus a few long-range "shortcut" links (a small-world graph, structurally similar to a 1988 university network of interconnected LANs). Every tick, for each edge (i, j) where i is infected and j is susceptible:
P(infect j this tick) = p_i (Bernoulli trial per edge)
An infected host is removed from the epidemic (patched/immune) with probability p_p per tick — modelling an administrator noticing and fixing the exploited services. The real 1988 worm carried a deliberate but badly-tuned defense against being shut down: before infecting a machine it was supposed to check whether a copy was already running there, but it skipped that check on a fraction of attempts (roughly 1-in-7) so that a determined system administrator couldn't kill it by faking the "already infected" signal. That flaw is reproduced here as the reinfection bug rate p_r: on every edge where j is already infected, a reinfection event fires with probability p_r, adding to that host's process/CPU load — which is exactly why the real worm crashed thousands of machines by resource exhaustion rather than any payload.
- pi — per-edge, per-tick chance the worm copies itself onto a reachable susceptible host.
- pp — per-tick chance an infected host gets patched and stops spreading.
- pr — per-tick, per-edge chance of a redundant reinfection landing on an already-infected host, driving up its visible pulse/load.
- Reseed — regenerates the network topology and restarts from a single patient-zero host.